Privacy, plainly.

Updated October 19, 2026 · Publisher: Aref GHOLAMI ZARANDI

Start on your device

Local inventory use is designed to work without an account. Food names, quantities, freezer locations, dates, notes and optional photos are stored on your device. Device backups and any files you export are also subject to your device and storage provider’s settings.

When you choose sync or sharing

Optional Sign in with Apple provides a private account identifier that connects your devices and controls household access. When Apple supplies your name, the app keeps it on your device for display. Stowberry does not request your email address from Apple.

Sync sends the inventory and changes you choose to sync, including optional photos, to our services. Household members can see the inventory shared with that household. Invitations, membership roles and change history support access control and conflict resolution.

Purchases

Apple handles payment. We do not receive your card details. RevenueCat processes purchase identifiers, subscription status, transaction information and an app user identifier so the app and server can verify Plus access and provide subscription analytics. Household access is based on verified entitlement status, not a purchase button alone.

Service providers

• Apple: app distribution, optional sign-in, purchases and device-level services.
• Cloudflare: website and API hosting, synchronized records in D1, private photos in R2, and email forwarding.
• RevenueCat: purchase verification and subscription management.
• Support email: messages you send are forwarded to the publisher’s support inbox. Include only information needed to answer your request.

These providers may process information in countries other than your own under their applicable terms and safeguards. We use data to provide the app, respond to support, prevent misuse and maintain reliable service.

Photos & storage

Cloud uploads must fit within 2 MiB before upload. Accepted photos are normalized, and each personal inventory or shared household has a separate 250 MiB photo allowance. Household members share that household’s allowance. Reaching a photo limit must not prevent text inventory from being used or exported. Cloud photos are private and require authorized access.

Household safety

Safety reports include your account identifier, household, the reason you provide and relevant reported content. Reports and the exact reported photo, when applicable, are kept for up to 90 days from the most recent report to investigate misuse. Report evidence can remain for that period after an account or household is deleted; it is available only to the publisher for safety review, not through the normal photo API. Block relationships are kept until unblocked or your account is deleted. The publisher reviews pending household photos and reports; personal photos do not enter that approval queue. Shared photos are withheld from other members until approved. Blocking ends shared access and hides the former household from your active inventory; recovery files you keep remain under your control.

Advertising & website tracking

Stowberry has no advertising or behavioral analytics. RevenueCat provides subscription analytics using purchase history and app user identifiers; it is not used for advertising tracking. This public website does not set analytics cookies or use marketing trackers. Hosting providers may process standard connection and security information, such as an IP address, to deliver and protect the service. The website contains no sign-up form.

Keeping and deleting information

Account deletion is available in Settings. Account deletion revokes account access and removes your personal cloud inventory and any household you own. Items and photos you contributed to a household owned by someone else remain available to that household; your photo-uploader attribution is removed. Leaving a household also leaves its shared contributions in place. Account deletion completes after sign-in access is revoked and active owned cloud data is removed. If a provider is temporarily unavailable, deletion remains pending and retries automatically; the app does not report completion prematurely. Encrypted database recovery copies can persist for up to 30 days before they age out. Private photo cleanup is retried for 24 hours to cover requests already in progress. Safety reports and their reported image evidence may remain for up to 90 days after the latest applicable report, even after account deletion or household closure, and are restricted to the publisher for review.

Inventory, deleted-item markers and change history are retained while an account remains active so devices can synchronize correctly. The app shows recent history for 30 days; that display window is not a promise to erase older synchronization records. Limited diagnostic and security logs are retained for up to seven days. We do not automatically delete an inactive account; you can request account deletion at any time. Support correspondence is kept as needed to resolve requests and meet applicable obligations.

Removing a household member revokes future online access. It cannot remotely erase inventory already cached on an offline device, retained as a personal copy, exported or backed up. Leaving, deletion and subscription-expiry flows explain those limits.

Your choices

• Use local inventory without signing in.
• Choose whether to add photos, enable reminders or join a household.
• Export your inventory and manage your own backup copies.
• Delete an account in the app, or contact us with an access, correction or deletion request.

Reminder permission can be changed in iOS Settings. Subscription cancellation is managed separately through Apple.

Contact & changes

For privacy questions or requests, contact Aref GHOLAMI ZARANDI at privacy@stowberry.app. We may ask for limited information to verify a request without asking for your password.

We will update this page when data handling changes. This page will reflect changes to the app and its service configuration.